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Abstrakt 


The aim of this paper is to assess the capability of the internal audit function in 
the Serbian public sector to add value to the public sector entities by performing 
its work effectively, to support progress of and achieve the requirements of EU 
Chapter 32 — Financial control, opened in 2015. We reviewed the annual reports 
regularly published by the Ministry of finance as well as SAI’s annual activity 
reports for the period from 2016 to 2022. The results of our analysis show that the 
internal audit function in the Serbian public sector is still at the initial stage of its 
development. Our recommendation refers to the change of the model of 
organization of the internal audit function in the small entities and providing 
adequate resources for internal auditor’s continual professional education. 


Keywords: EU Chapter 32 — Financial control, public sector internal auditors, 
size of audit function, continual professional education, Serbia. 
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Introduction 


The fundamental premise of the Three Lines Model or the public sector is that the 
governments and other public sector entities are essential for maintaining orderly 
and fair societies (INTOSAI and The Institute of Internal Auditors 2022). These 
entities operate on behalf of the public and use public resources, and consequently 
bear responsibility for the effective, efficient, ethical, equitable and sustainable 
management of the public sector resources. The decision making and operating 
processes of public sector entities must be transparent to all stakeholders. 
Establishing process of good governance, including internal audit function as a 
third line is essential for good governance. Budgeting and public financial 
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management (PFM) are probably the most important instruments for proper 
implementation of public policies. PFM deals with the management of public 
resources, the allocation and use of resources collected from the economy. 


Starting from 2015, the Republic of Serbia implemented a comprehensive set of 
reforms in the field of public finance management with the aim of increasing 
accountability, ensuring good financial management, and improving the efficiency 
and effectiveness of public resource management. This set of activities is included 
in the Public Financial Management Reform Program (PFMRP). The first part of 
this program took place in the period 2016-2020, and the second covers the period 
from 2021-2025 (Government of the Republic of Serbia 2021). 


PFMRP pertains to the Cluster I — Basics within the public administration reform 
program and is important for macroeconomic stability, good governance, business 
environment, transparency and the similar. This program is the base for a few 
other EU negotiation chapters (Government of the Republic of Serbia 2021). A 
few of these chapters were opened in the previous period, 5 — Public procurement 
(December 13, 2016), 17-Economic and monetary policy (December 10, 2018), 
29-Customs union (June 20, 2017), 32-Financial control (December 14, 2015) and 
33-Financial and budgetary provisions (June 25, 2018) (Republika Srbija n.d.). 


To develop transparency in public finances, the Law on the Budget System 
(Republika Srbija 2009 ..2021) defined a comprehensive system of measures for 
the management and control of public revenues, expenditures, assets, and 
liabilities, established by the government through public sector organizations. 
with the aim of managing and controlling public funds in accordance with the 
regulations, the budget, and the principles of good financial management, 1.e., 
economy, efficiency, effectiveness, and openness. Financial management and 
control (FMC) in Serbia are regulated in line with the COSO model (Republika 
Srbija Ministarstvo finansija 2018), a framework for internal control, enterprise 
risk management, and fraud deterrence developed by the Committee of 
Sponsoring Organizations of the Treadway Commission (COSO). PFMRP was 
the first reliable framework for monitoring of results of implementation of new 
governance system and financial management policies (Government of the 
Republic of Serbia 2021). 


Public internal financial control 


The most famous and widely recognized definition of internal control is the one 
by COSO. COSO defines internal control as “a process, affected by people, 
designed to provide reasonable assurance regarding the achievement of objectives 
in the following categories: effectiveness and efficiency of operations, reliability 
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of financial reporting, and compliance with applicable laws and regulations.” (The 
Committee of Sponsoring Organizations of the Treadway Commission (COSO) 
2013). 


The aim of the public internal financial control (PIFC) system is primarily based 
on the management responsibility, which is defined by the Law on the Budget 
System as the obligation of managers at all levels of users of public funds to 
perform all work legally, respecting the principles of economy, effectiveness, 
efficiency, and publicity, as well as that their decisions, procedures, and results 
correspond to whoever appointed them or delegated responsibility to them. The 
Law on the Budget System stipulates that PIFC includes financial management 
and control of users of public funds, internal audit of users of public funds and 
harmonization and coordination of financial management and control and internal 
audits performed by Central harmonization unit (CHU) of the Ministry of finance. 


The European Commission staff working document for Serbia in 2015 addressed 
several issues that are necessary for improving financial controls, as mentioned in 
Chapter 32 — Financial control (European Commission 2015). According to the 
Report, Serbia has already made some progress in terms of external audits. 
However, the principle of managerial accountability was not fully integrated into 
the management culture of public sector entities yet. The working document 
emphasized the need for annual review reports on the implementation of public 
internal financial control (PIFC) by CHU, which should include reviewing the 
implementation results, a comprehensive analysis of systemic weaknesses and 
propose corrective measures. 


Internal auditing in the public sector 


The assumption that the management is responsible for ensuring the establishment 
of internal control is widely accepted. In a broad sense, internal control includes 
all the controls operated by an organization to facilitate it to achieve its goals. The 
internal audit provides assurance that an adequate and effective internal control 
system is put in place. 


Internal audit plays a critical role in a entity’s corporate governance. It is an 
operationally independent unit, checking that internal controls are working 
properly and making recommendations for optimization of controls. It should 
audit internal control systems, risk management, and corporate governance 
procedures. In the public sector, internal audit reports may be made available to 
the public upon request, in accordance with jurisdictional public record laws 
(INTOSAI and The Institute of Internal Auditors 2022). 
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In 2023, The Institute of Internal Auditors (The IIA) proposed new internal 
auditing standards. The proposed IIA’s Global Internal Audit Standards™ for the 
first time highlight the public sector’s unique characteristics, such as its purpose 
and governance structure. The new draft Standards include the definition of public 
sector which reads: “governments and all publicly controlled or publicly funded 
agencies, enterprises, and other entities that deliver public programs, goods, or 
services.” (The Institute of Internal auditors 2023). 


Draft of proposed standards pay significant attention to the public sector interest, 
referring to the public as the ultimate customer of all public sector services. 
Although the internal audit activity does not typically report directly to the public, 
proposed standards consider that all public sector internal audit work should be 
done on behalf of the public and with the public benefit and interest in mind. 
Consequently, internal auditors must assess what the organization is doing to 
provide value to the public. (The Institute of internal auditors 2022). 


Establishing and properly supporting internal audit functions within governments 
at all levels should be considered a universal best practice. The absence of internal 
audit functions within government could significantly increase the risk of fraud, 
waste, abuse, malfeasance, inefficiency, cybersecurity and data privacy breaches, 
national security failures, breakdowns in the provision of government services, 
reduced public accountability, a lowered ability to identify and manage current 
and emerging risks facing the government and its citizens, and wasted resources. 


In the case of the provision of internal audit services to smaller government 
subdivisions, policymakers may opt, for reasons of economies of scale, to set up 
internal audit functions that are shared among various entities. Options for 
outsourcing, sourcing or combined services enable the same team of auditors to be 
involved in audits across multiple entities. 


The latest apprehension of the purpose of internal auditing “acknowledges that 
internal auditing enhances the organization’s ability to serve the public interest, 
the collective well-being of the community of people, and entities that the auditors 
serve. This responsibility is an important characteristic of an internal audit in the 
public sector where the purpose of the organization is to provide services to the 
public.” (The Institute of Internal auditors 2023). 


The aim of the study is to examine the development of the internal audit function 
and its capabilities to effectively carry out its role in the public sector of the 
Republic of Serbia following the opening of EU Chapter 32 - Financial Control, in 
December 2015. 
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Methodology 


Ministry of finance - CHU monitors the work of internal audit in the public sector 
of the Republic of Serbia through the analysis of annual reports on the functioning 
of the internal controls system and internal audit submitted by public sector 
entities. The results of this analysis are presented in a consolidated annual report 
which have been regularly prepared since 2009. The consistency of the 
presentation of data varies over the years. Following the opening of EU accession 
Chapter 32 — Financial Control in 2015, the consistency of presentation 
significantly increased. The available data include the number of public entities 
that submitted their annual reports to the CHU, the status of internal audits in the 
reporting entities, the number of internal auditors, the number of audits, audit 
findings, and similar. The analysis of these data enables the assessment of the 
development of the function of internal auditing in the entire public sector. Since 
2016, the content and format of the consolidated annual report have been 
improved in accordance with European Committee recommendations. 


Serbian State audit institution (SAI) also reports on the development of the 
internal control system and internal auditing in the public sector for audited 
entities since 2007. SAI annual operating reports on the annual results of annual 
audit programs, thus, the greatest number of entities differs from year to year. 
Nevertheless, the considerable number of audited entities, on the other hand, 
represents a good base for an overall assessment of the status of internal auditing 
in the public sector, as all entities operate in the same environments and under the 
same regulation. 


For this paper, we analyzed the date for the period commencing in 2016, with the 
aim of assessing the results of the efforts invested in improving the internal audit 
function in the public sector following the opening of EU Chapter 32 - Financial 
Control, in December 2015. Although the dates are not consistently presented in 
all these reports, the lack of their consistency does not impact the overall 
assessment results. 


Results on the implementation process and discussion 


The development of internal control system and internal audit in the Serbian 
public sector can be tracked by analyzing reported data in the Serbian Ministry of 
finance CHU reports. For example, we can track the progress of awareness of 
public entities’ management on the importance of the implementation of the 
proposed processes in the public management system by the number of entities 
which submitted their reports to the Ministry of finance CHU. 
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Table 1. The number of entities which submitted their mandatory annual reports to 
the Ministry of Finance's Central harmonization unit (CHU 


Submitted | Processed Share of processed reports in the total number of 
reports | reports** entitites by selected type of entities 
e| alg E 
= ols ee 
2016* 724 628 No 16 3 
—— 
2017* 936 763 No 
a eer ee? oT 
2018* 1014 938 No 
oe 
2019*** 945 886 No 
% 100% 100% 72% 68% 53% 
2020**** | 2578 2578 No 
% 100% 88% 89% 81% 
2021** 2982 2982 No 
% 


Note: - data n/a 

Sources: Autor’s construct based on: * (Republika Srbija Ministarstvo finansija 2018) ** (Republika 
Srbija Ministarstvo finansija 2022); *** (Republika Srbija Ministarstvo finansija 2020) **** 
(Republika Srbija Ministarstvo finansija 2020) 


The data presented on the Table 1 reveals that the number of public entities which 
submit their reports on financial management and control (FUK) continualy 
increases, with the spike 2020. The difference between submitted reports and 
processed reports is another indicator of the quality of submitted reports. Namely, 
the differences relate to the emply reports. From 2020, all submitted reports were 
processed. Analysis of the structure of entities which submitted their reports, most 
difficulties occur at the municipality level, as the percentinge of municipalities 
which submitted their reports is the lowest. The overall assessment is positive, as 
the awareness of public entities management significantly raised. Part of this 
success relate to the intensive training of employees responsible for public 
management held in the latest period, as a greater number of public fund 
beneficiaries have undergone the training and submitted their first annual reports 
on financial management and control (Government of the Republic of Serbia 


2021). 
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FUK is a system of policies, procedures, and activities which provides reasonable 
assurance that the objectives of the public entity will be realized in a proper, 
economical, efficient, and effective way. The FUK system includes five 
interrelated elements that are defined in accordance with COSO framework: 
control environment, risk management, control activities, information and 
communication and monitoring and evaluation of the system. 


During the regular audit process, the State Audit Institution in Serbia (SAI) 
examines the FUK system. Based on performed reviews, SAI could not find 
assurance that the internal control system was established in a way to ensure 
operations in accordance with regulations, internal acts, and contracts in the 
majority of audited entities. It was also determined that the conditions for 
adequate functioning of the internal audit were not appropriate. The SAI’s 
analysis of irregularities in the functioning of financial controls reveals that the 
most of irregularities occur at the local level. 


Table 2. Irregularities in the functioning of financial controls in 2018 


Budgets NBS/|_ Total 
of local}]OMSI/users Public|political number 
Central] govern-| of funds of|enterprises/| parties/ of| 

Auditees budget] ments RHIF| institutions} other} cases 
Number of auditees — users of public funds 19 68 18 27 9 141 
Elements of the System 
Control environment 7 278 28 11 26 350 
Risk management 5 22 7 18 3 25: 
Control activities 21 407 46 30 11 515 
Information and communication 13 180 61 10 14 278 
Monitoring and evaluation 3 11 7 3 3 27 
Total 49 898 149 72 57|_ 1225 
Share in Total 4%| 73% 12% 6% 5%| 100% 
Average 3 13 8 3 6 9 
Note: - =n.d. 
Sources: Autors construct based on the (Drzavna revizorska institutcija 2019) 


Table 3. Development of the internal audit function in the public sector 


Number of entities with 


normative internal audit 


Percent of entities with three internal 


Type of entity Total number of entities function auditors 
2016]2017|2018}2019|2020|2021/2016|]2017|2018/2019|2020|2016/2017| 2018] 2019] 2020] 2021 

Ministries 

with 

administrative 

bodies in the 

composition 16] 18} 18} 18} 21] 25}; 16) 18] 15] 16] 16 - -| 39% 39%] 33%] 48% 
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Other direct 

budget 

beneficiaries 

at the central 

level* -| 5 84} 86} 85} 56} 28 17| 18 


OOSO** 3 a ala ata aad gt 100% 100%] 100%|100% 


AP Vojvodina - - - 1 1 1 - {100%} 100%] 100% 
Cities - -| 28) 28} 28 - M4 21%} 21%] 21%] 25% 
Municipalities - 117) 117} 117} 1 : - - - - 


Public 
enterprizes at 
the central 


WI 


level -| 34) 37} 39} 41} 39} 33 24; 21) 22 - -| 50%} 40%} 50%]! 57% 
Total - -| 288} 293| 297| 270 - -| 106} 96} 102 
Notes: - = n.d. 


*Other direct budget beneficiaries at the central level - administrations, agencies, funds, judicial bodies ...; 
**OOSO — The pension and disability insurance fund of the Republic of Serbian, Republic fund of health insurance 
and National employment service. 

Sources: Authors’ construct based on (Republika Srbija Ministarstvo finansija 2017), (Republika Srbija 
Ministarstvo finansija 2018) (Republika Srbija Ministarstvo finansya 2019) (Republika Srbija Ministarstvo 
finansija 2020), (Republika Srbija Ministarstvo finansija 2021), (Republika Srbija Ministarstvo finansija 2022), 


The scope of the audit is primarily analyzed according to the scope of the internal 
auditing of the budget by categories of given entities. The results presented in 
Table 5 show most of the budget expenditures occur in entities with functional 
internal auditing. 


Table 4. The scope of re budget of public entities audited by internal auditors 


(In percent of realized budget) 2018 2019 2020 2021 


Ministries with administrative bodies in 

the composition 

Other direct budget beneficiaries at the 93 87 93 94 
central level 


OOSO 


AP Vojvodina 
Cities 


Municipalities 

Public enterprizes at the central level (in 

percent of total income) 

Source: Authors’ construct, based on the (Republika Srbija Ministarstvo finansija 2019), 
(Republika Srbija Ministarstvo finansija 2021), (Republika Srbija Ministarstvo finansija 2021), 
(Republika Srbija Ministarstvo finansija 2022). 


Although the data on the assessment of the quality of internal auditing work is not 
available, an average number of internal auditors by public entities raises 
skepticism about its quality (Table 6). 
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Table 5. The number of internal audit functions and internal auditors in the Serbian 
public sector 


The number of public sector entities Average 


number of 
internal 
auditors by 
entity 


With normatively With functionaly The number The number 

established established of proposed of acctual 

internal audit internal audit postions postions 
function function 


2016* 195 417 2.1 
2017* 445 2.0 
2018* 483 2.0 
2019** 485 1.8 
2020** 1.6 
2021** 538 1.5 
Note: - =n.d. 


Sources: Autors’ construct, based on * (Republika Srbija Ministarstvo finansija 2018) and ** 
(Republika Srbija Ministarstvo finansija 2022). 


The data in the table above reveal that the average number of internal auditors by 
a public entity is between 1,5 and 2,1, with the continually decreasing trend. The 
average number of internal auditors at the central level, presented in Table 7, is 
above average for the entire public sector. Thus, the decreasing trend may be 
explained by the increase in the number of entities that establish internal audit 
functions with one or two internal auditors in the internal audit function. 


Table 6. Established intern! audit functions and proposed and actual number of 
internal auditors in public entities at the central level in 2021 
Number of internal audit Number of Average number 
function auditors of internal auditor 


Type of entity Acctual 
Ministries with 
administrative bodies 
in the composition 


Other direct budget 
beneficiaries at the 
central level 


OOSO 
Public enterprizes at 
the central level 


Cities and 
municipalities 
Public enterprizes at 
the local level 84 46 252 184 3,0 4,0 
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Sources: Authors construct based on * (Republika Srbija Ministarstvo finansija 2020), ** 
(Republika Srbija Ministarstvo finansija 2022). 


During its regular audit process, State audit instituion in Serbia (SAI) examines 
internal audit function. Auditees are the direct and indirect beneficiaries of the 
budget funds, beneficiaries of funds of organizations of mandatory social 
insurance, the public enterprises, units of territorial autonomy and local self- 
government, the National Bank of Serbia in the part relevant to use of public 
funds, and all other users of public funds (State Audit Institution 2019). 


Table 7. The status of internal audit function in audited entities 


2016} 2017] 2018} 2019} 2020} 2021} 2022 
Number of entities subject to internal audit 162} 200} 150} 158 173} 216} 212 
Functional internal audit 17%|_ 20%| 22%} 43% 43%| 41%| 36% 
Formaly established but not functional 8%} 4%] 5%} 11% 3%|  4%| 7% 
No internal audit function 75%| 77%| 73%| 46% 54%| 55%} 57% 
Total 100%] 100%} 100%] 100%} 100%| 100%} 100% 


Source: Authors construct based on the data presented in the State Audit Institution Annual 
Reports on Operations for the referred year. 


Professional competencies of internal auditors 


To comply with the International standards for the professional practice of 
internal auditing, internal auditors must obtain appropriate professional 
designation and possess or obtain the knowledge, skills and abilities to perform 
their responsibilities successfully (The Institute of internal auditors 2017). 
Funding for training and professional development should be included in the 
internal audit budget, i.e. provided by the organizations. Training opportunities 
may include enrolling in courses, working with a mentor, or being assigned new 
tasks under supervision during an engagement. Membership in a professional 
organization is also beneficial for maintaining internal audit knowledge on a day- 
to-day basis. 


According to the regulation of internal auditing applied in the public sector of the 
Republic of Serbia, the duty of internal auditors is to improve their knowledge, 
skills, and other abilities through continuous professional development. The 
Rulebook on professional training of certified internal auditors in the Serbian 
public sector prescribes the areas and forms of professional training of authorized 
internal auditors in the public sector and criteria for recognizing professional 
training (Republika Srbija, Ministar finansija 2019). The Ministry of Finance 
CHU publishes the Record of professional training of certified internal auditors in 
the Serbian public sector. The records show that only fifty percent of public sector 
internal auditors obtain continual professional education, and subsequently 
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maintain their professional designation. The summary of these records is 
presented in Table 9 (Republika Srbija Ministarstvo finansija 2021). 


The number of public sector internal auditors who are the members of the most 
influential professional organization is presented in the annual reports of the IIA 
Serbia (Udruzenje internih revizora Srbije n.d.). These figures show that only ten 
percent of public sector internal auditors are members of this professional 
organization. 


Table 8. Professional competencies of internal auditors in the public sector 


The number of internal auditors | The number of certified public 
The number who reported results on their sector internal auditors who are 
of internal continuing professional the members of the IIA 
Year auditors education*** Serbia**** 

2016* 417 - 30 
2017* 445 - 29 
2018* 483 - 71 
2019** 485 - 50 
2020** 526 251 58 
2021** 538 267 53 
2022. - 268 - 


Source: Authors’ construct based on * (Republika Srbija Ministarstvo finansija 2019), ** 
(Republika Srbija Ministarstvo finansija 2022), *** (Republika Srbija Ministarstvo finansija 
2021), **** (UdruZenje internih revizora Srbije n.d.) 


Conclusion and recommentations 


The aim of the study is to examine the development of the internal audit function 
and its capabilities to effectively carry out its role in the public sector of the 
Republic of Serbia following the opening of EU Chapter 32 - Financial Control, in 
December 2015. 


Despite the advanced normative regulation, operating capabilities of the internal 
audit function in the public sector are in the initial phase. This conclusion is based 
on two results. The first is that the average number of auditors in public entities 
continually decreases, from 2.1 in 2016 to 1.5 in 2021. The number of public 
entities that have established internal audit functions continually increases, but the 
actual number of auditors in these entities varies between | and 2. It is hard to 
believe that such a small number of internal auditors can comply with 
international internal audit standards. Analysis of the qualifications of public 
sector internal auditors reveals that about half of them do not have access to 
continual professional education, which is of the utmost importance for qualified 
professionals. Moreover, just ten percent of public sector internal auditors are 
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members of authoritative professional organization IIA Serbia and majority of 
them have no access to the cheapest source for continual professional education. 


The research finds an increase in awareness of the value of internal auditing since 
the opening of the EU Chapter 32. The analysis of irregularities in the functioning 
of internal control systems reveals that the greatest average number of 
irregularities occur at the local level, in entities with the least developed internal 
audit function. The least irregularities occur at the central level and public entities 
owned by the central government, with the functional internal audit function. We 
conclude that a key public sector challenge is to ensure appropriate internal audit 
at the local level. 


The overall conclusion is that internal audit function, regardless of its well-done 
normative regulation, has not significantly improved its capabilities to effectively 
carry out its role in the Serbian public sector since the opening of the EU Chapter 
32 — Financial control. 


Based on the findings enumerated above, the following are some 
recommendations that will improve the capability of internal audit functions in 
performing their roles and responsibilities: The first one refers to the promotion of 
compound internal audit function with more auditors, whereas internal audit staff 
is concentrated at one point and performs internal auditing for more entities. The 
second one refers to providing adequate resources and incentives for public sector 
internal auditors for their intensive continual professional education. 
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